What to Do After a Data Breach
Whether hackers breached your company’s servers, or someone accidentally uncovered sensitive data online, a Data Breach has serious consequences for both you and your customers. These include fines for violating external regulations, financial losses to victims, and reputational damage that can be irreparable.
A data breach occurs when an attacker gets access to confidential information, usually personal and financial information such as credit card numbers or Social Security numbers. Attackers can steal data through a variety of methods including physical attacks on point-of-sale devices, which commonly use skimming devices to collect payment card data; hacking into systems through software vulnerabilities; and theft of portable drives or paper documents.
Once inside the system, attackers can do what they want with it. This could include stealing data for sale or to commit fraud; destroying it; or locking up the data and demanding a ransom, which is becoming increasingly common in cyber attacks.
After a breach, businesses must take immediate steps to contain the breach, investigate its cause and scope, and notify people whose records were compromised. Affected consumers need to know what to expect, which means clear and concise communication, not just about the breach itself but also about how they can protect themselves from phishing scams in the future.
Develop a response plan that includes forensics experts who can capture forensic images of affected machines, help determine what was stolen and how it happened, and outline remediation steps. Work with legal counsel to review your notification requirements, as laws vary by jurisdiction.